The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input and external API responses while having network and file-writing capabilities.
Ingestion points: User prompts, video_url input, and JSON data returned from gateway.pixazo.ai as described in SKILL.md.
Capability inventory: Executes network requests via curl, Python's requests library, and Node.js fetch. Performs file system operations to write API keys and modify permissions (chmod 600) in SKILL.md.
Boundary markers: None present. The instructions do not define delimiters or provide guidance to ignore instructions embedded in the processed data.
Sanitization: No evidence of input validation or output escaping is found in the instructions.
[EXTERNAL_DOWNLOADS]: The skill fetches documentation from the vendor's domain and suggests installing additional software.
Evidence: Instructions point the agent to fetch reference schemas from https://www.pixazo.ai/models/audio-extract-api.md.
Evidence: Mentions an installation command npx skills add Pixazo-AI/skills for retrieving components from the vendor's GitHub organization.
[METADATA_POISONING]: The skill's YAML frontmatter contains contradictory information.
Evidence: The description field claims the skill is for "Image generation/editing", whereas the name and body specify it is for "Audio Extractor API" functionality.
[COMMAND_EXECUTION]: The skill involves the execution of shell commands for environment setup and secret management.
Evidence: Instructs the agent to save sensitive keys to ~/.pixazo/api-key and update permissions using chmod 600.

audio-extract-api